Insider Threat Investigator

Los Alamos National Security LLC; Los Alamos (NM); On-site; USD 110,000 - 165,000; Full time

Benefits offered by this job

Health insurance

Dental and vision insurance

Life and disability insurance

Paid parental leave

401(k) with match

Tuition assistance

Flexible schedules and PTO

Onsite gyms and wellness programs

Relocation assistance

Job summary

Los Alamos National Laboratory seeks an experienced Insider Threat Investigator to lead and support complex investigations, assess indicators, and produce clear findings for technical and senior audiences.

You will collaborate across OCI, security, cybersecurity, HR, and legal teams to safeguard LANL assets while protecting privacy and due process. A strong background in counterintelligence investigations and DOE policies is essential.

Qualifications

• Extensive experience conducting complex investigations from planning to reporting.
• Ability to brief senior decision-makers on findings and recommendations.
• Strong written and verbal communication for diverse audiences.

Responsibilities

• Conduct and support insider threat investigations including data exfiltration and security violations.
• Collect and correlate information from counterintelligence, cybersecurity, HR, legal and security teams.
• Develop investigative plans, timelines, and documented findings.

Skills

Investigative experience

Analytical skills

Interpersonal skills

Written communication

Education

Bachelor's degree in criminal justice/cybersecurity/security management

Tools

DLP/UEBA/SIEM knowledge

Privacy and records management

Job description

What You Will Do

This position is open for external candidates only to apply.

Are you an experienced insider threat or counterintelligence professional? Are you interested in joining a dedicated team of professionals working to safeguard Los Alamos National Laboratory (LANL), its people, information, and mission? If so, we invite you to learn more about our opening for an Insider Threat Investigator 3. The Insider Threat Investigator 3 will support the identification, assessment, investigation, and mitigation of potential insider threats to LANL. The successful candidate will work across counterintelligence, security, cybersecurity, human resources, legal, and management functions to evaluate concerning activity while appropriately protecting employee privacy, due process, and organizational assets. This position requires a seasoned investigator with strong investigative and analytical skills, sound judgment, discretion, and demonstrated ability to objectively assess complex information and distinguish anomalous or legitimate workplace activity from behaviors that may warrant further inquiry.

LANL investigative efforts support national counterintelligence and insider threat goals and objectives under the direction of the Foreign Immigration, Visits and Analysis (FVA) Group Leader and the Office of Counterintelligence (OCI) Director.

In this position, you will:

• Conduct and support investigations involving suspected insider threat activity, including unauthorized disclosures, misuse of information or systems, data exfiltration, security violations, fraud, sabotage, and other potentially harmful activity.
• Collect, review, analyze, and correlate information from authorized counterintelligence, cybersecurity, personnel security, physical security, investigative, and other relevant sources.
• Develop investigative strategies, plans, timelines, leads, and documented findings.
• Conduct investigative interviews and coordinate investigative activities with appropriate internal and external stakeholders.
• Identify and assess behavioral, technical, and other indicators that may warrant additional inquiry or assessment.
• Evaluate investigative information objectively, distinguish anomalous activity from substantiated risk, and develop well-supported findings and recommendations.
• Prepare clear, concise, and factual investigative reports, briefings, referrals, and case documentation for technical and senior‑level audiences.
• Maintain investigative records in accordance with applicable laws, policies, privacy requirements, and records‑management standards.
• Collaborate with counterintelligence, cybersecurity, legal, human resources, employee relations, physical security, personnel security, and other organizational functions, as appropriate.
• Support insider threat assessments and develop proportionate, risk‑informed recommendations for mitigation.
• Identify investigative trends, recurring indicators, and lessons learned that can strengthen LANL's insider threat posture, security controls, and prevention efforts.
• Handle sensitive, controlled, and classified information with discretion and professionalism.

What You Need

Minimum Job Requirements:

Counterintelligence and/or Insider Threat Investigative Experience

Demonstrated extensive experience conducting complex, end‑to‑end investigations, including investigative planning, information collection, interviewing, analysis of qualitative and quantitative information, development of findings, and preparation of investigative reports. Demonstrated knowledge of investigative principles and practices, evidence handling, privacy and civil liberties considerations, records management, and information‑protection requirements. Knowledge of insider threat concepts, indicators, investigative methodologies, organizational roles, and relevant policies and authorities, such as Executive Order 13587 and DOE Order 470.5A. Familiarity with cybersecurity and insider threat capabilities such as data loss prevention (DLP), security information and event management (SIEM), user and entity behavior analytics (UEBA), or related security technologies.

Analysis, Reports, and Briefings

Demonstrated experience analyzing complex and potentially conflicting information, developing defensible findings and recommendations, and preparing professional investigative reports and other written products.

Demonstrated experience briefing investigative findings, assessments, and recommendations to decision‑makers, including senior management.

Communication and Interpersonal Skills

Demonstrated ability to build productive working relationships and collaborate effectively across organizational and functional boundaries. Ability to interact professionally with personnel throughout LANL, the Department of Energy Office of Intelligence and Counterintelligence (DOE‑IN), other DOE counterintelligence and insider threat field elements, and external liaison partners, as appropriate. Demonstrated ability to represent OCI professionally on working groups, investigative teams, and other collaborative forums. Excellent written and verbal communication skills, including the ability to communicate complex or sensitive information clearly, objectively, and appropriately for the intended audience.

Education/Experience:

Position typically requires a bachelor's degree in criminal justice, cybersecurity, intelligence studies, security management, behavioral science, or a related discipline and a minimum of eight years of related experience, or an equivalent combination of education and experience. At this level, postgraduate coursework may be desirable.

Desired Qualifications:

DOE Insider Threat

Experience supporting or working within the DOE Insider Threat Program, including familiarity with DOE insider threat policies, processes, investigative practices, and organizational responsibilities. Insider threat professional certification or equivalent training is preferred. A successful candidate who does not possess required insider threat professional certification upon hire will be expected to obtain applicable certification as soon as practicable.

DOE Counterintelligence

Experience supporting the DOE Counterintelligence Program, including knowledge of foreign intelligence service methods, counterintelligence principles and practices, and nontraditional foreign intelligence collection methodologies.

US Intelligence Community Experience

Substantial experience within or supporting the U.S. Intelligence Community and familiarity with relevant intelligence and counterintelligence authorities, policies, organizations, missions, and roles, including Executive Order 12333 and other applicable Intelligence Community policy.

Classification

Current Derivative Classifier certification is desired. A successful candidate who is not certified upon hire will be expected to obtain applicable Derivative Classifier certification as soon as practicable.

Language

Professional proficiency in a foreign language relevant to national security or counterintelligence missions is desired.

Clearance

An active DOE Q clearance and Sensitive Compartmented Information (SCI) access are preferred. Candidates must possess the ability to obtain and maintain all clearances and accesses required for the position.

Work Location:

The work location for this position is onsite and located in Los Alamos, NM. All work locations are at the discretion of management.

Position commitment:

Regular appointment employees are required to serve a period of continuous service in their current position in order to be eligible to apply for posted jobs throughout the Laboratory. If an employee has not served the time required, they may only apply for Laboratory jobs with the documented approval of their Division Leader. The position commitment for this position is 1 year.

Note to Applicants:

With your application and résumé, please include a cover letter detailing how you meet each of the required skills for the position and, upon completion of the interview, be prepared to provide a writing sample. Although the position will not ordinarily require extensive travel, the successful candidate must be able to travel domestically on occasion to accommodate training or operational needs.

Due to federal restrictions contained in the current National Defense Authorization Act, citizens of the People's Republic of China - including the special administrative regions of Hong Kong and Macau - as well as citizens of the Islamic Republic of Iran, the Democratic People's Republic of North Korea, and the Russian Federation, who are not Lawful Permanent Residents("green card" holders) are prohibited from accessing facilities that support the mission, functions, and operations of national security laboratories and nuclear weapons production facilities, which includes Los Alamos National Laboratory.

Where You Will Work

Located in beautiful northern New Mexico, Los Alamos National Laboratory (LANL) is a multidisciplinary research institution engaged in strategic science on behalf of national security. Our generous benefits package includes:

• PPO or High Deductible medical insurance with the same large nationwide network
• Dental and vision insurance
• Free basic life and disability insurance
• Paid maternity and parental leave
• Award‑winning 401(k) (6% matching plus 3.5% annually)
• Learning opportunities and tuition assistance
• Flexible schedules and time off (PTO)
• Onsite gyms and wellness programs
• Extensive relocation packages (outside a 50 mile radius)

Additional Details

Directive 206.2 -

Employment with Triad requires a favorable decision by NNSA indicating employee is suitable under NNSA Supplemental Directive 206.2. Please note that this requirement applies only to citizens of the United States. Foreign nationals are subject to a similar requirement under DOE Order 142.3A.

Clearance: Q/SCI

(Position will be cleared to this level). Selected applicants will be subject to a background investigation conducted by or on behalf of the Federal Government, and must meet eligibility requirements* for access to classified matter. This position requires a Q clearance. and obtaining such clearance requires US Citizenship except in extremely rare circumstances. Dependent upon the position, additional authorization to access classified information may be required, which may or may not be available to dual citizens. Receipt of a Q clearance and additional access authorization ultimately is a decision of the Federal Government and not of Triad.

*Eligibility requirements: To obtain a clearance, an individual must be at least 18 years of age; U.S. citizenship is required except in very limited circumstances. See DOE Order 472.2 for additional information.

New-Employment Drug Test:

The Laboratory requires successful applicants to complete a new‑employment drug test and maintains a substance abuse policy that includes random drug testing. Although New Mexico and other states have legalized the use of marijuana, use and possession of marijuana remain illegal under federal law. A positive drug test for marijuana will result in termination of employment, even if the use was pre‑offer.

Regular position:

Term status Laboratory employees applying for regular‑status positions are converted to regular status.

Equal Opportunity:

Los Alamos National Laboratory is an equal opportunity employer and supports a diverse and inclusive workforce. All employment practices are based on qualification and merit, without regard to race, color, national origin, ancestry, religion, age, sex, gender identity, sexual orientation or preference, marital status or spousal affiliation, physical or mental disability, medical conditions, pregnancy, status as a protected veteran, genetic information, or citizenship within the limits imposed by federal laws and regulations. The Laboratory is also committed to making our workplace accessible to individuals with disabilities and will provide reasonable accommodations, upon request, for individuals to participate in the application and hiring process. To request such an accommodation, please send an email to [e-mail] or call 1‑505‑665‑4444 option 1.